CVE-2021-45105

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

View graph Watch Export

CVSS v3.1

5.9 MEDIUM

EPSS

99.9%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityHIGH

Privileges RequiredNONE

User InteractionNONE

ScopeUNCHANGED

ConfidentialityNONE

IntegrityNONE

AvailabilityHIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Timeline

disclosure → media coverage

Dec 18, 2021

Disclosure — published as a CVE record. · last revised by NVD Aug 25, 2026

Public PoC (7)

github.com/cckuailong/Log4j_dos_CVE-2021-45105 github.com/pravin-pp/log4j2-CVE-2021-45105 github.com/tejas-nagchandi/CVE-2021-45105 github.com/iAmSOScArEd/log4j2_dos_exploit github.com/dileepdkumar/https-github.com-pravin-pp-log4j2-CVE-2021-45105-1 github.com/name/log4j-remediation github.com/aajuvonen/CVE-2021-45105-demo

Unverified third-party code — review before executing.